tenderlove/nokogiri — Issue #580: Enhance handling of missing closing quotation marks in attributes 
Author: rbreu
Created: 2011-12-02 12:15:46+00:00
State: open

(using Nokogiri 1.5.0)

Missing a closing quotation mark in an attribute:

Nokogiri::HTML.parse('<html><body><a href="foo.org>link</a><em>stuff</em></body></html>').to_s
=> "<!DOCTYPE html PUBLIC \"-//W3C//DTD HTML 4.0 Transitional//EN\" \"http://www.w3.org/TR/REC-html40/loose.dtd\">\n<html><body><a href=\"foo.org&gt;link&lt;/a&gt;&lt;em&gt;stuff&lt;/em&gt;&lt;/body&gt;&lt;/html&gt;\"></a></body></html>\n"

Leads to the whole rest of the document ending up inside the attribute. I'm using Nokogiri for sanitising user input, and it's very annoying for the user if they want to edit their input and correct their mistake, since everything ends up escaped. I wonder if one could be a bit smarter as to where to end the attribute? Since unescaped > isn't allowed in attributes, that might be a good hint, or maybe at the following closing a tag?